▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0718-0746 `v1.8.4` range-select v2 **IMPORTANT:** `v1.8.2` (previous release) fixed [CVE-2023-37474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37474) ; please see the [1.8.2 release notes](https://github.com/9001/copyparty/releases/tag/v1.8.2) (all serverlogs reviewed so far showed no signs of exploitation) * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) ## new features * #47 file selection by shift-clicking * in list-view: click a table row to select it, then shift-click another to select all files in-between * in grid-view: either enable the `multiselect` button (mainly for phones/tablets), or the new `sel` button in the `[⚙️] settings` tab (better for mouse+keyboard), then shift-click two files * volflag `fat32` avoids a bug in android's sdcardfs causing excessive reindexing on startup if any files were modified on the sdcard since last reboot ## bugfixes * minor corrections to the new features from #45 * uploader IPs are now visible for `a`dmin accounts in `d2t` volumes as well ## other changes * the admin-panel is only accessible for accounts which have the `a` (admin) permission-level in one or more volumes; so instead of giving your user `rwmd` access, you'll want `rwmda` instead: ```bash python3 copyparty-sfx.py -a joe:hunter2 -v /mnt/nas/pub:pub:rwmda,joe ``` or in a settings file, ```yaml [/pub] /mnt/nas/pub accs: rwmda: joe ``` * until now, `rw` was enough, however most readwrite users don't need access to those features * grabbing a stacktrace with `?stack` is permitted for both `rw` and `a` ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ # 2023-0714-1558 `v1.8.2` URGENT: fix path traversal vulnerability * read-only demo server at https://a.ocv.me/pub/demo/ * [docker image](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) ╱ [similar software](https://github.com/9001/copyparty/blob/hovudstraum/docs/versus.md) ╱ [client testbed](https://cd.ocv.me/b/) Starting with the bad and important news; this release fixes https://github.com/9001/copyparty/security/advisories/GHSA-pxfv-7rr3-2qjg / [CVE-2023-37474](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37474) -- so please upgrade! Every version until now had a [path traversal vulnerability](https://owasp.org/www-community/attacks/Path_Traversal) which allowed read-access to any file on the server's filesystem. To summarize, * Every file that the copyparty process had the OS-level permissions to read, could be retrieved over HTTP without password authentication * However, an attacker would need to know the full (or copyparty-module-relative) path to the file; it was luckily impossible to list directory contents to discover files on the server * You may have been running copyparty with some mitigations against this: * [prisonparty](https://github.com/9001/copyparty/tree/hovudstraum/bin#prisonpartysh) limited the scope of access to files which were intentionally given to copyparty for sharing; meaning all volumes, as well as the following read-only filesystem locations: `/bin`, `/lib`, `/lib32`, `/lib64`, `/sbin`, `/usr`, `/etc/alternatives` * the [nix package](https://github.com/9001/copyparty#nix-package) has a similar mitigation implemented using systemd concepts * [docker containers](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker) would only expose the files which were intentionally mounted into the container, so even better * More conventional setups, such as just running the sfx (python or exe editions), would unfortunately expose all files readable by the current user * The following configurations would have made the impact much worse: * running copyparty as root So, three years, and finally a CVE -- which has been there since day one... Not great huh. There is a list of all the copyparty alternatives that I know of in the `similar software` link above. Thanks for flying copyparty! And especially if you decide to continue doing so :-) ## new features * #43 volflags to specify thumbnailer behavior per-volume; * `--th-no-crop` / volflag `nocrop` to specify whether autocrop should be disabled * `--th-size` / volflag `thsize` to set a custom thumbnail resolution * `--th-convt` / volflag `convt` to specify conversion timeout * #45 resulted in a handful of opportunities to tighten security in intentionally-dangerous setups (public folders with anonymous uploads enabled): * a new permission, `a` (in addition to the existing `rwmdgG`), to show the uploader-IP and upload-time for each file in the file listing * accidentally incompatible with the `d2t` volflag (will be fixed in the next ver) * volflag `nohtml` is a good defense against (un)intentional XSS; it returns HTML-files and markdown-files as plaintext instead of rendering them, meaning any malicious `